@runeya/runeya 2.0.125 → 2.0.127

package/{src-SGSG2RSF.js → src-J3RBNMRJ.js}

@@ -17,7 +17,9 @@ import {
   apiKeyStore,
   appVersion,
   applyPersistedLanMode,
+  attachServiceToProject,
   auditService,
+  buildServerBuiltins,
   canEnvAction,
   chatRouter,
   cloudAuthRouter,
@@ -29,6 +31,7 @@ import {
   environmentResolver,
   executeKanbanBoardCommands,
   executeKanbanCommands,
+  filterEnvForAi,
   generateLlmsTxt,
   getActiveProvider,
   getAllowedServiceIds,
@@ -62,7 +65,7 @@ import {
   soleAccountScope,
   startCliSession,
   vaultOfProject
-} from "./chunk-GKK3ACWB.js";
+} from "./chunk-LHVTBWM7.js";
 import {
   resolveCliInvocation,
   whichCommand
@@ -85,7 +88,7 @@ import {
   stopClaudeTranscriptWatcher,
   stopCodexTranscriptWatcher,
   verifyJwt
-} from "./chunk-H22YLVQE.js";
+} from "./chunk-UKLNK5YA.js";
 import "./chunk-MD3VW4HQ.js";
 import {
   agentManager,
@@ -127,15 +130,16 @@ import {
   stableEncryptValue,
   traefikManager,
   unregisterInstance
-} from "./chunk-4PN7QBNM.js";
+} from "./chunk-WQWRTPPJ.js";
 import {
   settingsManager
-} from "./chunk-N3ZI35SC.js";
+} from "./chunk-QPII36FL.js";
 import {
   atomicWriteSecure,
+  renameWithRetry,
   resolveConversationRunDir,
   sweepStaleTempFiles
-} from "./chunk-HK5QNU6P.js";
+} from "./chunk-BDQOBEZ3.js";
 import {
   AGENT_LONG_FETCH_TIMEOUT,
   AGENT_STOP_FETCH_TIMEOUT,
@@ -160,16 +164,19 @@ import {
   UpdateEnvironmentSchema,
   VariableOverrideSchema,
   VariableSchema,
+  VariableSlotSchema,
   ambiguousServiceSlugs,
   crossServiceSlugsIn,
   deriveLauncherIdentity,
+  findUnresolvedReferences,
   getCollection,
   nativeParsers,
   primaryServiceLink,
   readEntity,
   serviceSlug,
+  suggestBuiltinReferences,
   writeEntity
-} from "./chunk-T2BV5WZE.js";
+} from "./chunk-TTPL2M74.js";
 import {
   allVaultRoots,
   env,
@@ -541,7 +548,7 @@ import { mkdir } from "fs/promises";
 
 // ../server/src/services/master-password.ts
 import { randomBytes, createCipheriv, createDecipheriv } from "crypto";
-import { readFile, writeFile, chmod, stat, rename } from "fs/promises";
+import { readFile, writeFile, chmod, stat } from "fs/promises";
 import { join as join2 } from "path";
 import { Entry } from "@napi-rs/keyring";
 import { hashRaw as argon2HashRaw } from "@node-rs/argon2";
@@ -587,7 +594,7 @@ async function writePepperToFile(dataDir, pepper) {
   const tmpPath = filePath + ".tmp";
   await writeFile(tmpPath, pepper.toString("hex"), "utf-8");
   await chmod(tmpPath, 384);
-  await rename(tmpPath, filePath);
+  await renameWithRetry(tmpPath, filePath);
 }
 function tryKeyringGet() {
   try {
@@ -638,7 +645,7 @@ async function writeEncryptedKey(dataDir, masterPassword, encryptionKey, pepperD
   const tmpPath = filePath + ".tmp";
   await writeFile(tmpPath, encoded, "utf-8");
   await chmod(tmpPath, 384);
-  await rename(tmpPath, filePath);
+  await renameWithRetry(tmpPath, filePath);
 }
 async function readEncryptedKey(dataDir, masterPassword, pepperDir = dataDir) {
   const filePath = join2(dataDir, ENCRYPTED_KEY_FILENAME);
@@ -664,7 +671,7 @@ async function writeVerifyFile(dataDir, encryptionKey) {
   const filePath = join2(dataDir, VERIFY_FILENAME);
   const tmpPath = filePath + ".tmp";
   await writeFile(tmpPath, payload.toString("base64"), "utf-8");
-  await rename(tmpPath, filePath);
+  await renameWithRetry(tmpPath, filePath);
 }
 async function verifyEncryptionKey(dataDir, encryptionKey) {
   const filePath = join2(dataDir, VERIFY_FILENAME);
@@ -943,27 +950,10 @@ var projectRouter = router({
     orgId: z4.string().max(128).nullable().optional(),
     serviceId: z4.string().max(128)
   })).mutation(async ({ input }) => {
-    const target = { id: input.projectId, orgId: input.orgId };
-    const project = await projectStore.addService(target, input.serviceId);
+    const project = await attachServiceToProject({ id: input.projectId, orgId: input.orgId }, input.serviceId);
     if (!project) {
       throw new TRPCError2({ code: "NOT_FOUND", message: `Project ${input.projectId} not found` });
     }
-    const service = await serviceStore.get(input.serviceId);
-    if (service) {
-      const globalEnvs = await environmentStore.listByScope(input.projectId, "global", input.orgId);
-      for (const globalEnv of globalEnvs) {
-        const svcEnv = await environmentStore.create({
-          projectId: input.projectId,
-          name: `${service.name} (${globalEnv.name})`,
-          scope: "service",
-          reference: input.serviceId,
-          activateOn: globalEnv.id,
-          parentIds: [globalEnv.id],
-          variables: {}
-        }, input.orgId);
-        await projectStore.addEnvironment(target, svcEnv.id);
-      }
-    }
     await auditService.log({
       userId: "local",
       action: "update",
@@ -1926,8 +1916,86 @@ var setupRouter = router({
 });
 
 // ../server/src/trpc/routers/environment.ts
+import { randomUUID } from "crypto";
 import { z as z9 } from "zod";
 import { TRPCError as TRPCError6 } from "@trpc/server";
+
+// ../server/src/services/ai-variable-write.ts
+var AiVariableWriteError = class extends Error {
+};
+function planAiVariableWrite(existing, input) {
+  if (!existing) {
+    return {
+      key: input.key,
+      value: VariableSlotSchema.parse({
+        value: input.value ?? "",
+        ...input.pre !== void 0 ? { pre: input.pre } : {},
+        ...input.post !== void 0 ? { post: input.post } : {},
+        isSecret: input.isSecret ?? false,
+        ...input.description !== void 0 ? { description: input.description } : {}
+      })
+    };
+  }
+  const slot = existing.value;
+  if (slot.isSecret && input.isSecret === false) {
+    throw new AiVariableWriteError(`${input.key} is a secret: an AI cannot make it public. Ask the user to change it in Runeya.`);
+  }
+  if (slot.overrideOnly && input.value !== void 0) {
+    throw new AiVariableWriteError(`${input.key} is override-only: it has no shared value, each machine sets its own. Ask the user to fill it in Runeya.`);
+  }
+  return {
+    key: existing.key,
+    value: {
+      ...slot,
+      ...input.value !== void 0 ? { value: input.value } : {},
+      ...input.pre !== void 0 ? { pre: input.pre } : {},
+      ...input.post !== void 0 ? { post: input.post } : {},
+      ...input.isSecret ? { isSecret: true } : {},
+      ...input.description !== void 0 ? { description: input.description } : {}
+    }
+  };
+}
+
+// ../server/src/services/ai-environments.ts
+function describeEnvironmentsForAi(environments, context) {
+  return environments.map((env2) => {
+    const scope = env2.scope ?? "global";
+    return {
+      id: env2.id,
+      name: env2.name,
+      scope,
+      active: env2.id === context.activeEnvironmentId,
+      parentIds: env2.parentIds ?? [],
+      ...scope === "service" && env2.reference ? { serviceId: env2.reference } : {},
+      ...scope === "service" && env2.reference && context.serviceNames[env2.reference] ? { serviceName: context.serviceNames[env2.reference] } : {},
+      ...env2.activateOn ? { activateOn: env2.activateOn } : {},
+      ...scope === "service" && env2.activateOn ? { isolated: !(env2.parentIds ?? []).includes(env2.activateOn) } : {},
+      variables: Object.values(env2.variables ?? {}).map((v) => ({
+        key: v.key,
+        secret: v.value.isSecret,
+        required: v.value.required,
+        overrideOnly: v.value.overrideOnly,
+        ...v.value.description ? { description: v.value.description } : {}
+      }))
+    };
+  });
+}
+
+// ../server/src/trpc/routers/environment.ts
+async function builtinsForEnvironment(environment) {
+  const project = await projectStore.get(environmentStore.projectRefOf(environment) ?? environment.projectId);
+  if (!project) return {};
+  const services = (await Promise.all(project.serviceIds.map((id) => serviceStore.get(id)))).filter((service) => service !== null);
+  const own = environment.scope === "service" ? services.find((service) => service.id === environment.reference) : void 0;
+  const subject = own ?? services[0];
+  if (!subject) return {};
+  const values = buildServerBuiltins({
+    service: subject,
+    siblings: services.filter((service) => service.id !== subject.id),
+    host: env.HOST
+  });
+  return own ? values : Object.fromEntries(Object.entries(values).filter(([name]) => name.startsWith("services.")));
+}
 var environmentRouter = router({
   list: protectedProcedure.input(z9.object({
     projectId: z9.string().max(128),
@@ -2138,6 +2206,130 @@ var environmentRouter = router({
     if (!result) throw new TRPCError6({ code: "INTERNAL_SERVER_ERROR", message: "Failed to update variable" });
     return result;
   }),
+  /**
+   * Les environnements d'un projet pour une IA : où ranger une variable, qui
+   * hérite de qui, lequel est actif — sans aucune valeur (`describeEnvironmentsForAi`).
+   * Une clé d'API n'y voit que les environnements qu'elle peut lire.
+   */
+  listForAi: protectedProcedure.input(z9.object({
+    projectId: z9.string().max(128),
+    orgId: z9.string().max(128).nullable().optional()
+  })).query(async ({ input, ctx }) => {
+    const project = await projectStore.get({
+      id: input.projectId,
+      ...input.orgId !== void 0 ? { orgId: input.orgId } : {}
+    });
+    if (!project) throw new TRPCError6({ code: "NOT_FOUND", message: `Project ${input.projectId} not found` });
+    const environments = (await environmentStore.list(input.projectId, input.orgId)).filter((env2) => canEnvAction(ctx, env2.id, "env:read"));
+    const serviceNames = {};
+    for (const serviceId of project.serviceIds) {
+      const service = await serviceStore.get(serviceId);
+      if (service) serviceNames[serviceId] = service.name;
+    }
+    return describeEnvironmentsForAi(environments, { activeEnvironmentId: project.activeEnvironmentId, serviceNames });
+  }),
+  /**
+   * Ce que produit un environnement seul, parents et surcharges du poste
+   * compris, tel qu'une IA peut le lire : secrets non partagés masqués par le
+   * même filtre que `service.getEnv`. Les variables intégrées ne sont pas
+   * remplies — elles dépendent du service qui les reçoit — mais une référence
+   * qui ne correspond à rien est nommée.
+   */
+  resolveForAi: protectedProcedure.input(z9.object({ environmentId: z9.string().max(128) })).query(async ({ input, ctx }) => {
+    requireEnvAction(ctx, input.environmentId, "env:read");
+    const env2 = await environmentStore.get(input.environmentId);
+    if (!env2) throw new TRPCError6({ code: "NOT_FOUND", message: `Environment ${input.environmentId} not found` });
+    const [resolved, shared] = await Promise.all([
+      environmentResolver.resolveEnvironment(input.environmentId),
+      environmentResolver.resolveAiSharedKeys(input.environmentId)
+    ]);
+    const filtered = filterEnvForAi(resolved, shared);
+    return {
+      environmentId: env2.id,
+      name: env2.name,
+      scope: env2.scope ?? "global",
+      ...filtered,
+      unresolvedReferences: findUnresolvedReferences(resolved.env, { serverResolved: false, skipKeys: filtered.hiddenKeys })
+    };
+  }),
+  /**
+   * Écrire une variable pour le compte d'une IA, désignée par son nom.
+   *
+   * La route des outils IA (`set_environment_variable`) : les règles de
+   * `planAiVariableWrite` y tiennent quel que soit l'appelant — une IA ne rend
+   * pas un secret public et ne le partage jamais avec les IA. La réponse ne
+   * porte aucune valeur : ce qui vient d'être écrit peut être un secret.
+   */
+  setVariableBlind: protectedProcedure.input(z9.object({
+    environmentId: z9.string().max(128),
+    key: z9.string().min(1).max(256),
+    value: z9.string().max(8192).optional(),
+    pre: z9.string().max(8192).optional(),
+    post: z9.string().max(8192).optional(),
+    isSecret: z9.boolean().optional(),
+    description: z9.string().max(2e3).optional()
+  })).mutation(async ({ input, ctx }) => {
+    requireEnvAction(ctx, input.environmentId, "env:write");
+    const env2 = await environmentStore.get(input.environmentId);
+    if (!env2) throw new TRPCError6({ code: "NOT_FOUND", message: `Environment ${input.environmentId} not found` });
+    const found = Object.entries(env2.variables).find(([, v]) => v.key === input.key);
+    const variableId = found?.[0] ?? randomUUID();
+    let variable;
+    try {
+      variable = planAiVariableWrite(found?.[1], input);
+    } catch (err) {
+      if (err instanceof AiVariableWriteError) throw new TRPCError6({ code: "FORBIDDEN", message: err.message });
+      throw err;
+    }
+    const result = await environmentStore.upsertVariable(input.environmentId, variableId, variable);
+    if (!result) throw new TRPCError6({ code: "INTERNAL_SERVER_ERROR", message: "Failed to write variable" });
+    const written = `${variable.value.pre}${variable.value.value}${variable.value.post}`;
+    let suggestions = [];
+    if (!variable.value.isSecret) {
+      try {
+        suggestions = suggestBuiltinReferences(written, await builtinsForEnvironment(env2));
+      } catch (err) {
+        console.warn("[environment-router] Built-in suggestions unavailable for", input.environmentId + ":", err.message);
+      }
+    }
+    return {
+      environmentId: input.environmentId,
+      variableId,
+      key: variable.key,
+      isSecret: variable.value.isSecret,
+      created: !found,
+      ...suggestions.length > 0 ? { suggestions } : {}
+    };
+  }),
+  /**
+   * L'interrupteur « Hérite / Isolé » d'un environnement de service, pour une
+   * IA : le même geste que l'interface (`ServiceConfigEnv.vue`, `toggleInheritance`)
+   * — ses parents vidés, ou remis à l'environnement global qui l'active. Par
+   * une route dédiée parce que `update` rend l'environnement entier, valeurs
+   * comprises.
+   */
+  setInheritanceBlind: protectedProcedure.input(z9.object({ environmentId: z9.string().max(128), inherit: z9.boolean() })).mutation(async ({ input, ctx }) => {
+    requireEnvAction(ctx, input.environmentId, "env:write");
+    const env2 = await environmentStore.get(input.environmentId);
+    if (!env2) throw new TRPCError6({ code: "NOT_FOUND", message: `Environment ${input.environmentId} not found` });
+    if (env2.scope !== "service" || !env2.activateOn) {
+      throw new TRPCError6({ code: "BAD_REQUEST", message: `Environment ${input.environmentId} is not a service environment: only those inherit from, or are isolated from, the global environment that activates them` });
+    }
+    const updated = await environmentStore.update({ id: env2.id, parentIds: input.inherit ? [env2.activateOn] : [] });
+    if (!updated) throw new TRPCError6({ code: "INTERNAL_SERVER_ERROR", message: "Failed to update inheritance" });
+    return { environmentId: env2.id, isolated: !input.inherit };
+  }),
+  /** Retirer une variable par son nom, pour le compte d'une IA : la réponse ne porte aucune valeur. */
+  removeVariableBlind: protectedProcedure.input(z9.object({ environmentId: z9.string().max(128), key: z9.string().min(1).max(256) })).mutation(async ({ input, ctx }) => {
+    requireEnvAction(ctx, input.environmentId, "env:write");
+    const env2 = await environmentStore.get(input.environmentId);
+    if (!env2) throw new TRPCError6({ code: "NOT_FOUND", message: `Environment ${input.environmentId} not found` });
+    const found = Object.entries(env2.variables).find(([, v]) => v.key === input.key);
+    if (!found) throw new TRPCError6({ code: "NOT_FOUND", message: `Variable ${input.key} not found in environment ${input.environmentId}` });
+    const result = await environmentStore.removeVariable(input.environmentId, found[0]);
+    if (!result) throw new TRPCError6({ code: "INTERNAL_SERVER_ERROR", message: "Failed to remove variable" });
+    return { environmentId: input.environmentId, key: input.key, removed: true };
+  }),
   /**
    * List everywhere a variable key is used inside a project: environments that
    * define it, and variables that reference it through {{environment.KEY}}.
@@ -2900,7 +3092,7 @@ import { resolve, join as join4 } from "path";
 import { homedir as homedir2 } from "os";
 
 // ../server/src/services/user-config-manager.ts
-import { readFile as readFile2, writeFile as writeFile2, rename as rename2, mkdir as mkdir2, chmod as chmod2 } from "fs/promises";
+import { readFile as readFile2, writeFile as writeFile2, mkdir as mkdir2, chmod as chmod2 } from "fs/promises";
 import { join as join3 } from "path";
 import { homedir } from "os";
 import { z as z11 } from "zod";
@@ -2931,7 +3123,7 @@ var UserConfigManager = class {
     const filePath = join3(CONFIG_DIR, CONFIG_FILE);
     const tmpPath = filePath + ".tmp";
     await writeFile2(tmpPath, JSON.stringify(data, null, 2), "utf-8");
-    await rename2(tmpPath, filePath);
+    await renameWithRetry(tmpPath, filePath);
     await chmod2(filePath, 384);
   }
   async getConfig() {
@@ -3422,7 +3614,7 @@ Rules:
 });
 
 // ../server/src/trpc/routers/scenario.ts
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID as randomUUID3 } from "crypto";
 import { TRPCError as TRPCError13 } from "@trpc/server";
 import { z as z15 } from "zod";
 
@@ -3539,7 +3731,7 @@ async function* streamWithActiveProvider(opts) {
 
 // ../server/src/services/scenario-runner.ts
 import { mkdir as mkdir4 } from "fs/promises";
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 import { join as join6 } from "path";
 
 // ../server/src/services/scenario-presets.ts
@@ -3881,7 +4073,7 @@ function applyHireDirectivesFromOutput(manager, scenario, output) {
   }
   const hired = [];
   for (const payload of hireDirectives) {
-    const id = `hire-${randomUUID().slice(0, 8)}`;
+    const id = `hire-${randomUUID2().slice(0, 8)}`;
     const position = computeHirePosition(manager, scenario.nodes);
     ensureGroupCanContainNode(scenario, manager.groupId ?? null, position);
     const node = {
@@ -5049,7 +5241,7 @@ var scenarioRouter = router({
   })).mutation(({ input }) => {
     const now = Date.now();
     return createOrBadRequest(async () => scenarioStore.create({
-      id: randomUUID2(),
+      id: randomUUID3(),
       name: input.name,
       icon: input.icon,
       description: input.description,
@@ -5201,7 +5393,7 @@ var scenarioRouter = router({
 });
 
 // ../server/src/trpc/routers/debug.ts
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID4 } from "crypto";
 import { TRPCError as TRPCError14 } from "@trpc/server";
 import { z as z16 } from "zod";
 var MAX_BUFFER2 = 300;
@@ -5264,7 +5456,7 @@ var debugRouter = router({
     intervalMs: z16.number().int().min(100).max(5e3).optional(),
     maxTicks: z16.number().int().min(1).max(1e4).optional()
   }).optional()).mutation(({ input }) => {
-    const jobId = randomUUID3();
+    const jobId = randomUUID4();
     const intervalMs = input?.intervalMs ?? 400;
     const maxTicks = input?.maxTicks ?? 500;
     const job = {
@@ -5484,7 +5676,7 @@ var diagnosticsRouter = router({
 import { z as z18 } from "zod";
 
 // ../server/src/services/kanban-queue.ts
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 import { EventEmitter as EventEmitter2 } from "events";
 var KanbanQueueService = class extends EventEmitter2 {
   items = [];
@@ -5512,7 +5704,7 @@ var KanbanQueueService = class extends EventEmitter2 {
       return { id: alreadyRunning.id, addedAt: alreadyRunning.startedAt, ...item };
     }
     const queueItem = {
-      id: randomUUID4(),
+      id: randomUUID5(),
       ...item,
       addedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
@@ -6265,7 +6457,7 @@ var utilityRouter = router({
 // ../server/src/trpc/routers/wiki.ts
 import { z as z22 } from "zod";
 import { TRPCError as TRPCError18 } from "@trpc/server";
-import { readFile as readFile3, readdir as readdir2, stat as stat4, realpath, writeFile as writeFile5, mkdir as mkdir6, rename as rename3, rm as rm2 } from "fs/promises";
+import { readFile as readFile3, readdir as readdir2, stat as stat4, realpath, writeFile as writeFile5, mkdir as mkdir6, rename, rm as rm2 } from "fs/promises";
 import { resolve as resolvePath, join as join8, relative, sep, dirname as dirname3 } from "path";
 var SCOPE_SCHEMA = z22.union([
   z22.literal("global"),
@@ -6462,7 +6654,7 @@ var wikiRouter = router({
       if (err instanceof TRPCError18) throw err;
     }
     await mkdir6(dirname3(to), { recursive: true });
-    await rename3(from, to);
+    await rename(from, to);
     return { fromPath: input.fromPath, toPath: input.toPath, ok: true };
   }),
   ensureRoot: protectedProcedure.input(z22.object({ scope: SCOPE_SCHEMA })).mutation(async ({ input }) => {
@@ -6586,7 +6778,7 @@ async function reconcileOrgCanary(orgId) {
 }
 
 // ../server/src/services/cloud-sync-bridge.ts
-import { randomUUID as randomUUID6 } from "crypto";
+import { randomUUID as randomUUID7 } from "crypto";
 import { mkdir as mkdir7, rm as rm3 } from "fs/promises";
 import * as Y2 from "yjs";
 
@@ -6594,7 +6786,7 @@ import * as Y2 from "yjs";
 import { readFileSync, renameSync, rmSync, writeFileSync, mkdirSync } from "fs";
 import { readFile as readFile4 } from "fs/promises";
 import { dirname as dirname4, join as join10 } from "path";
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 import * as Y from "yjs";
 var FILE = "sync-doc.bin";
 function cachePath(orgId) {
@@ -6626,7 +6818,7 @@ function writeSyncDocSync(orgId, state) {
   } catch {
   }
   mkdirSync(dirname4(path), { recursive: true });
-  const tmp = `${path}.${process.pid}.${randomUUID5()}.tmp`;
+  const tmp = `${path}.${process.pid}.${randomUUID6()}.tmp`;
   try {
     writeFileSync(tmp, mergeWith(existing, state), { mode: 384 });
     renameSync(tmp, path);
@@ -6679,7 +6871,7 @@ var OrgSyncConnection = class {
   services = getCollection(this.doc, "services");
   environments = getCollection(this.doc, "environments");
   logParsers = getCollection(this.doc, PARSERS);
-  conn = randomUUID6();
+  conn = randomUUID7();
   link;
   stopped = false;
   initializing = true;
@@ -7609,7 +7801,7 @@ var CloudSyncBridge = class {
 var cloudSyncBridge = new CloudSyncBridge();
 
 // ../server/src/services/key-adoption.ts
-import { readdir as readdir3, readFile as readFile5, writeFile as writeFile6, mkdir as mkdir8, copyFile, rename as rename4, stat as stat5 } from "fs/promises";
+import { readdir as readdir3, readFile as readFile5, writeFile as writeFile6, mkdir as mkdir8, copyFile, rename as rename2, stat as stat5 } from "fs/promises";
 import { join as join11 } from "path";
 import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, randomBytes as randomBytes2 } from "crypto";
 var ALGORITHM = "aes-256-gcm";
@@ -7722,7 +7914,7 @@ async function adoptOrgKey(orgId, newKey, masterPassword, now) {
   for (const item of pending) {
     const tmp = item.path + ".tmp";
     await writeFile6(tmp, item.content, "utf-8");
-    await rename4(tmp, item.path);
+    await rename2(tmp, item.path);
   }
   await installOrgKey(orgId, newKey, masterPassword);
   clearVaultLock(orgId);
@@ -8484,7 +8676,7 @@ async function ensureFilePermissions() {
 }
 
 // ../server/src/services/vault-migration.ts
-import { readdir as readdir5, readFile as readFile6, writeFile as writeFile7, mkdir as mkdir9, copyFile as copyFile2, unlink, rename as rename5, stat as stat8 } from "fs/promises";
+import { readdir as readdir5, readFile as readFile6, writeFile as writeFile7, mkdir as mkdir9, copyFile as copyFile2, unlink, rename as rename3, stat as stat8 } from "fs/promises";
 import { join as join13 } from "path";
 var KEY_FILES = [".encryption.key.enc", ".runeya-verify"];
 var MACHINE_FILES = [
@@ -8537,7 +8729,7 @@ async function migrateLegacyVault(legacyRoot, machineRootDir, legacyKey, machine
     if (counter.n === 0) continue;
     const tmp = join13(legacyRoot, `${name}.tmp`);
     await writeFile7(tmp, JSON.stringify(converted, null, 2), "utf-8");
-    await rename5(tmp, join13(legacyRoot, name));
+    await rename3(tmp, join13(legacyRoot, name));
     rekeyed.push({ file: name, values: counter.n });
   }
   for (const { file, values } of rekeyed) {
@@ -8573,7 +8765,7 @@ async function migrateLegacyVault(legacyRoot, machineRootDir, legacyKey, machine
 }
 
 // ../server/src/services/settings-migration.ts
-import { readFile as readFile7, writeFile as writeFile8, rename as rename6, unlink as unlink2, mkdir as mkdir10, chmod as chmod4, stat as stat9 } from "fs/promises";
+import { readFile as readFile7, writeFile as writeFile8, rename as rename4, unlink as unlink2, mkdir as mkdir10, chmod as chmod4, stat as stat9 } from "fs/promises";
 import { join as join14 } from "path";
 var SETTINGS_FILE = "settings.json";
 var SETTINGS_PRIVATE_FILE = "settings.private.json";
@@ -8592,7 +8784,7 @@ async function moveInto(root, filename, from) {
   const contents = await readFile7(from, "utf-8");
   const tmp = to + ".tmp";
   await writeFile8(tmp, contents, "utf-8");
-  await rename6(tmp, to);
+  await rename4(tmp, to);
   await chmod4(to, 384);
   await unlink2(from);
 }
@@ -8627,11 +8819,11 @@ async function migrateSettingsIntoVaults() {
 // ../server/src/migrations/migrate-from-legacy.ts
 import { createRequire } from "module";
 import { randomBytes as randomBytes3, createCipheriv as createCipheriv3, createDecipheriv as createDecipheriv3 } from "crypto";
-import { randomUUID as randomUUID7 } from "crypto";
+import { randomUUID as randomUUID8 } from "crypto";
 import {
   readFile as readFile8,
   writeFile as writeFile9,
-  rename as rename7,
+  rename as rename5,
   mkdir as mkdir11,
   access as access2,
   readdir as readdir6
@@ -8774,7 +8966,7 @@ async function decryptLegacyFile(filePath, key, sodium) {
 async function atomicWrite(path, data) {
   const tmp = path + ".tmp";
   await writeFile9(tmp, JSON.stringify(data, null, 2), "utf-8");
-  await rename7(tmp, path);
+  await rename5(tmp, path);
 }
 async function runLegacyMigration(dataDir) {
   const legacyRoot = env.DATA_DIR;
@@ -8787,10 +8979,10 @@ async function runLegacyMigration(dataDir) {
   console.log("[legacy-migration] Legacy Runeya data detected, starting migration\u2026");
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").substring(0, 19);
   const legacyTmp = `${legacyRoot}-tmp`;
-  await rename7(legacyRoot, legacyTmp);
+  await rename5(legacyRoot, legacyTmp);
   await mkdir11(dataDir, { recursive: true });
   const legacyOld = join15(dataDir, `backup-${timestamp}`);
-  await rename7(legacyTmp, legacyOld);
+  await rename5(legacyTmp, legacyOld);
   console.log(`[legacy-migration] Legacy data backed up to ${legacyOld}`);
   const keyJson = JSON.parse(await readFile8(join15(legacyOld, "dbs", "encryption-key.json"), "utf-8"));
   const sodium = await getSodium();
@@ -8845,11 +9037,11 @@ async function runLegacyMigration(dataDir) {
     const data = await readEncrypted(join15(parsersDir, file));
     if (data?.id) legacyParsers.push(data);
   }
-  const projectMonoId = randomUUID7();
+  const projectMonoId = randomUUID8();
   const envIdMap = {};
   const labelToKey = {};
   for (const [name, legacyEnv] of Object.entries(legacyEnvs)) {
-    envIdMap[name] = randomUUID7();
+    envIdMap[name] = randomUUID8();
     if (legacyEnv?.label) labelToKey[legacyEnv.label] = name;
   }
   const runeEnvs = [];
@@ -8874,7 +9066,7 @@ async function runLegacyMigration(dataDir) {
         if (hasInvalidInterpolation(value)) continue;
         const cleaned = cleanVarKey(key);
         if (inheritedVars[cleaned] === value) continue;
-        const varId = randomUUID7();
+        const varId = randomUUID8();
         variables[varId] = makeVariable(cleaned, value);
         varIdLookup.set(`${envIdMap[name]}:${cleaned}`, varId);
       }
@@ -8895,7 +9087,7 @@ async function runLegacyMigration(dataDir) {
   const serviceIdMap = {};
   const runeServices = [];
   for (const [name, legacy] of Object.entries(legacyServices)) {
-    const id = randomUUID7();
+    const id = randomUUID8();
     serviceIdMap[name] = id;
     const rootPath = legacy.rootPath || "";
     const rootPathCwd = rootPath && rootPath !== "." ? rootPath : "";
@@ -8904,7 +9096,7 @@ async function runLegacyMigration(dataDir) {
       const parts = [cmd.spawnCmd, ...cmd.spawnArgs || []].filter(Boolean);
       if (!parts.length) continue;
       commands.push({
-        id: cmd.id || randomUUID7(),
+        id: cmd.id || randomUUID8(),
         label: "Launch",
         command: parts.join(" "),
         cwd: cmd.spawnOptions?.cwd || "",
@@ -8965,7 +9157,7 @@ async function runLegacyMigration(dataDir) {
       const legacyBootstrapCmds = container.bootstrap?.commands || [];
       if (legacyBootstrapCmds.length > 0) {
         dockerConfig.bootstrapCommands = legacyBootstrapCmds.filter((bs) => bs.cmd || bs.entrypoint).map((bs, idx) => ({
-          id: bs.id || randomUUID7(),
+          id: bs.id || randomUUID8(),
           label: bs.label || `Bootstrap ${idx + 1}`,
           command: bs.cmd || "",
           ...bs.entrypoint ? { entrypoint: bs.entrypoint } : {},
@@ -9013,7 +9205,7 @@ async function runLegacyMigration(dataDir) {
       cwd: serviceCwd,
       runner: dockerConfig ? "docker" : "native",
       shortcuts: (legacy.shortcuts || []).filter((s) => s.spawnCmd || s.label).map((s) => ({
-        id: s.id || randomUUID7(),
+        id: s.id || randomUUID8(),
         label: s.label || s.spawnCmd || "",
         command: [s.spawnCmd, ...s.spawnArgs || []].filter(Boolean).join(" "),
         ...s.spawnOptions?.cwd ? { cwd: s.spawnOptions.cwd } : {}
@@ -9053,7 +9245,7 @@ async function runLegacyMigration(dataDir) {
       );
       if (!svcScopedEnv) {
         svcScopedEnv = {
-          id: randomUUID7(),
+          id: randomUUID8(),
           projectId: projectMonoId,
           name: `${service?.name || name} (${globalEnv.name})`,
           scope: "service",
@@ -9077,7 +9269,7 @@ async function runLegacyMigration(dataDir) {
         const varPost = typeof varData === "object" ? String(varData.suffix ?? "") : "";
         if (!varKey || existingKeys.has(cleanVarKey(varKey))) continue;
         const cleaned = cleanVarKey(varKey);
-        const varId = randomUUID7();
+        const varId = randomUUID8();
         svcScopedEnv.variables[varId] = makeVariable(cleaned, varValue, varPre, varPost);
         existingKeys.add(cleaned);
       }
@@ -9097,7 +9289,7 @@ async function runLegacyMigration(dataDir) {
       );
       if (!svcScopedEnv) {
         svcScopedEnv = {
-          id: randomUUID7(),
+          id: randomUUID8(),
           projectId: projectMonoId,
           name: `${service?.name || serviceName} (${globalEnv.name})`,
           scope: "service",
@@ -9118,7 +9310,7 @@ async function runLegacyMigration(dataDir) {
         const baseEntry = Object.entries(svcScopedEnv.variables).find(([, v]) => v.key === cleaned);
         let varId = baseEntry?.[0];
         if (!varId) {
-          varId = randomUUID7();
+          varId = randomUUID8();
           svcScopedEnv.variables[varId] = {
             key: cleaned,
             value: { value: "", pre: "", post: "", isSecret: false, shareWithAi: false, injectIntoAi: false, required: false, overrideOnly: false, description: "" }
@@ -9148,13 +9340,13 @@ async function runLegacyMigration(dataDir) {
             flatOverrides[varId] = makeVariable(cleaned, value);
           }
         } else {
-          flatOverrides[randomUUID7()] = makeVariable(cleaned, value);
+          flatOverrides[randomUUID8()] = makeVariable(cleaned, value);
         }
       } else {
         const cleaned = cleanVarKey(key);
         const existingVarId = Object.entries(env2.variables).find(([, v]) => v.key === cleaned)?.[0];
         if (!existingVarId) {
-          const varId = randomUUID7();
+          const varId = randomUUID8();
           env2.variables[varId] = makeVariable(cleaned, value);
           varIdLookup.set(`${envId}:${cleaned}`, varId);
         }
@@ -9338,7 +9530,7 @@ async function runOverrideOnlyMigration(dataDir) {
         if (isSameAsBase(value, baseVar)) continue;
         flatOverrides[varId] = makeVariable(cleaned, value);
       } else {
-        flatOverrides[randomUUID7()] = makeVariable(cleaned, value);
+        flatOverrides[randomUUID8()] = makeVariable(cleaned, value);
       }
     }
   }
@@ -9375,7 +9567,7 @@ async function runOverrideOnlyMigration(dataDir) {
       );
       if (!svcScopedEnv) {
         svcScopedEnv = {
-          id: randomUUID7(),
+          id: randomUUID8(),
           projectId: globalEnv["projectId"],
           name: `${service?.["name"] || serviceName} (${globalEnv["name"]})`,
           scope: "service",
@@ -9397,7 +9589,7 @@ async function runOverrideOnlyMigration(dataDir) {
         const baseEntry = Object.entries(svcScopedEnv["variables"]).find(([, v]) => v.key === cleaned);
         let varId = baseEntry?.[0];
         if (!varId) {
-          varId = randomUUID7();
+          varId = randomUUID8();
           svcScopedEnv["variables"][varId] = {
             key: cleaned,
             value: { value: "", pre: "", post: "", isSecret: false, shareWithAi: false, injectIntoAi: false, required: false, overrideOnly: false, description: "" }
@@ -9417,7 +9609,7 @@ async function runOverrideOnlyMigration(dataDir) {
   }
   const migratedDir = overridesDir.replace(/overrides$/, "overrides-migrated");
   try {
-    await rename7(overridesDir, migratedDir);
+    await rename5(overridesDir, migratedDir);
     console.log(`[override-migration] Moved overrides/ \u2192 overrides-migrated/`);
   } catch (err) {
     console.warn(`[override-migration] Could not rename overrides dir: ${err.message}`);
@@ -10609,7 +10801,7 @@ async function createLocalServer() {
     ]);
     console.log("[server] Shutdown complete");
   };
-  const { initCompanion } = await import("./companion-OZODV5BR.js");
+  const { initCompanion } = await import("./companion-YB3SDDTU.js");
   initCompanion();
   return { app, server, wss, shutdown };
 }
@@ -10739,7 +10931,7 @@ function onTrayServicesChanged(listener) {
 }
 
 // ../server/src/services/tray-icon.ts
-import { mkdir as mkdir12, writeFile as writeFile10, rename as rename8 } from "fs/promises";
+import { mkdir as mkdir12, writeFile as writeFile10, rename as rename6 } from "fs/promises";
 import { join as join17 } from "path";
 
 // ../server/src/services/png-to-ico.ts
@@ -10939,7 +11131,7 @@ async function writeTrayIcon(stem, png, platform) {
 async function writeAtomic(path, bytes) {
   const tmp = `${path}.${process.pid}.tmp`;
   await writeFile10(tmp, bytes);
-  await rename8(tmp, path);
+  await rename6(tmp, path);
   return path;
 }
 async function resolveOrgLogo(orgId, platform) {
@@ -11056,4 +11248,4 @@ export {
   startProcess,
   stopProcess
 };
-//# sourceMappingURL=src-SGSG2RSF.js.map
+//# sourceMappingURL=src-J3RBNMRJ.js.map